NSE4 Authentication and VPN Practice Question

Answer analysis

Option-by-option breakdown

For each option: why learners choose it and why it is or isn't the right answer here.

• ✗

  To provide two-factor authentication using FortiToken

  Why it's wrong here

  FortiToken is a separate FortiOS feature used for two-factor authentication, requiring users to provide a one-time passcode in addition to their credentials. Fortinet Single Sign-On (FSSO) does not perform authentication or token validation; it passively monitors Active Directory for existing user login events to correlate usernames with IP addresses for policy enforcement. Therefore, this option confuses a multi-factor authentication mechanism with a directory-based single sign-on solution.

• ✗

  To sync FortiGate configuration with Active Directory

  Why it's wrong here

  FSSO is not a configuration management or synchronization service; it does not push firewall policies, objects, or settings to Active Directory, nor does it pull directory schema changes to update FortiGate. Instead, a collector agent polls domain controllers for security event logs or uses NetAPI to discover successful user logons, then relays that session data to the FortiGate. Configuration synchronization is handled by tools like FortiManager or FortiGate's own clustering/fabric features, so this option misrepresents the core function of FSSO.

• ✗

  To authenticate users against a RADIUS server

  Why it's wrong here

  RADIUS is an authentication protocol that validates user credentials against a backend server, but FSSO does not act as a RADIUS client or server. FSSO is purely a single sign-on mechanism that leverages the fact that users already authenticated to Active Directory at the desktop; it captures those existing login sessions and maps them to IP addresses. Unlike RADIUS, which processes Access-Request/Access-Accept exchanges, FSSO only consumes authentication event data that Active Directory has already generated, so this option inaccurately describes FSSO as an authentication method.

• ✓

  To collect user login events from Active Directory for user-based policies

  Why this is correct

  FSSO's primary function is to automatically identify users based on their existing Active Directory login events and map those events to the source IP address of the client machine. A collector agent on the network monitors domain controller security logs or uses RPC calls to track successful user logons, then sends this mapping to the FortiGate. This enables the firewall to enforce user-based policies without prompting for credentials, because the user has already been authenticated by AD. The wrong answers describe other security features, but this is the exact mechanism FSSO provides.

Go deeper

Related to this question